PT-2022-18602 · F5 · F5 Big-Ip Guided Configuration+2

Published 2022-05-05 · Updated 2022-05-13 · CVE-2022-27806

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP Advanced WAF, ASM, and ASM versions 11.6.x through 16.1.x F5 BIG-IP Guided Configuration versions prior to 9.0

Description The issue allows an authenticated attacker with the Administrator role to bypass Appliance mode restrictions. This is achieved through command injection vulnerabilities in undisclosed URIs within F5 BIG-IP Guided Configuration when running in Appliance mode.

Recommendations For F5 BIG-IP Advanced WAF, ASM, and ASM versions 11.6.x through 16.1.x, update to a version that is not affected by this issue. For F5 BIG-IP Guided Configuration versions prior to 9.0, update to version 9.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Administrator role to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2022-27806

Affected Products

F5 Big-Ip Apm

F5 Big-Ip Advanced Waf

F5 Big-Ip Guided Configuration

References · 4

• https://osv.dev/vulnerability/CVE-2022-27806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27806 · Security Note
• https://support.f5.com/csp/article/K68647001 · Vendor Advisory
• https://t.me/true_secator/2914 · Telegram Post